Keynote - Day 2 - Holly Foxcroft

Hi everyone. Um, I recognize some amazing familiar faces in the crowd. Um, everyone who's important is in this room. Um, but I do understand that there is the rookie track going on. And if I were you, I'd actually be going to support the rookie track because I seem to be on stages at cyber security uh both events, conferences, bides quite a lot. um which I'm extremely fortunate for. But I personally really support these community events in giving back to the community when it can be quite hard especially as cyber security has just grown so much and it can actually be seen what's like the glass ceiling for so many people. Um so I am absolutely

both honored to be here and delighted because I love meeting new people in our community. Um you may have known or seen talk. Has anyone seen talk at a conference before? Got a fan. I've got two fans. Thank you. Three, four fans. Um, some of my work mainly is talking about the work of neurodyiversity in cyber. Um, mainly the role of how neurode divergence is a catalyst towards cyber crime. looking at how we as a society have unfortunately created societal barriers for individuals who are neurode divergent or display neurode divergent traits and characteristics and back in day I was like hey these people are fantastic as cyber because I'm one of them um and it's kind of a

lot of where my career was focused around for a very very long time whilst also continuing my career in understanding business and cyber security collectively together. I now work at One Vanc. Has anyone heard of that company for the right reasons? Thank you. One advance. You may not have heard of us, but you will know we exist because you've used our software. If you've unfortunately had to call 111 any time, our software is when that call handler say, "Are you bleeding? Have you can you feel your left arm?" when they're just a call handler obviously going through that triage list that that belongs to us. Um what we also do is we write the software to catch

speedy cars and I thought being part of the senior um cyber security team would get me off that course but didn't unfortunately so I did have the joy of sitting in through a speed a course for one mile over that's all I got caught over um but literally did did my so we support um the world of work offering work software um and I am the organization's biso so business invision security officer. Um, in the world of cyber, the term is often known for what it is that it is a senior member of the cyber security leadership team who sits with one foot in the door of the whole organization in the strategic side of

the organization and one foot in the cyber security team. you're constantly trying to pull two together making sure that companies uh objectives are meeting with the cyber security strategy and flip and reverse an interesting role. If anyone would like to talk about role of the BSO, the BSO function, it's one I would talk about all day long. It's probably one I should have spoke about today because full disclosure, I forgot to do this presentation. Hazel reminded me a week going, "Are you still coming?" I was like, "Yeah, Hazel, do this talk." I kind of spoke about this before. Um, I have made my notes, which I'm going to be referring to just make sure I get my statistics right throughout the

talk. um in uh the world of obviously cyber security um we're looking more now into how that's supporting businesses both from a risk point of view from a regulation point of view but also a strategic a strategic move and differentiator within our markets. So for us at one advanced and for many software organizations being a secure organization and offering secure services really sets you apart from other businesses in the same sector. So what am I talking about today? How to stay cautious in our world our new world of AI adoption. So AI how many of us think it's the best thing? How many of us think it's really, really dangerous? Is that double-edged sword? Is that

double-edged sword? And how many of us have actually started to capitalize on what AI can do for us, both for our own uses, but for how we're using it within our organization? Quite a lot of us. How many of us are being forced to use AI? Fantastic. And is that through the business need or is it just because it's through productivity? >> You lose your license. >> You lose your license. Where do you work? >> Oh yeah, you told me outside. Wow, that's really interesting. Forced uses of AI. I've actually not come across that. It's always been a supplementary, but to actually use is that um sorry, I usually keep my talks quite transactional. When

you say you'll be forced to say, is it to check work or >> not enough to go around? [Music] >> Wow. Okay. Interesting. Okay. So I was reading through some survey reports um both 2024 and 2025 and there is a stark difference in the way that security professionals versus um more business leaders CEOs are actually still viewing AI. So back 2020 24 check my statistics 39% of security professionals had were concerned about AI adoption that raised to 59% in 2025. An EY study showed that 80% of respondents worried about the AI being used in their cyber attacks and 39% lacked in confidence in using the AI responsibly. Let's now look at 2025. That 39% went to 59% in terms of being

concerned. 80% respondents worried about AI attacks being used in cyber attacks. 99%. So, we're getting more worried about how AI is being adopted and used in cyber security terms. Now, this is where it gets into with business. In 2024, CEOs were more excited about AI than they actually are this year. There's really interesting statistics to come in this talk as to why that could be. But where are we going to get all this scary data from? Where are we getting all of our drive from? Mainly through acts of service, through community talks like we've got here today and because we're seeing so many different types of AI attacks, but also regulatory changes. Has anyone been reading on the Otter AI

case that's going on at the moment? Man, actually, we had a talk about Otter AI earlier this year or could have been last year. Is anyone familiar with Otter AI? Did anyone read their terms of use when it first came out? Oh, it was a bit gray. It was actually very concerning as to what it was going to be doing with your data. Now what AI what AI have actually been doing is it's been attaching itself to meeting notes and what it's um it's been taking that data storing it but it also just sends it out but it's also been learning on that data as well without letting well letting people know in very generic terms but

now it's been uh taken into a high court case as to how AI notes are taking both organization and personal data without other respondents knowing Um so looking into um what the external pressures are and external regulations looking into AI adoption there is help and support out there is continuing to manifest into something quite beautiful. If we look at what the NIST AI risk management framework looks at, which is one I personally work with with our head of application security when looking at both our own AI that we have at one advanced, but how we are ultimately managing the risk of AI within our organization. Other ones is the ISO I can never say the ISO numbers correctly. We probably

will say them very differently. Uh the ISO 23894. Does anyone else say it like that or is there another way of saying that one? Fantastic. So I wanted this talk to talk about how I at one advanced and previous to one advanced I've been personally approaching the road map of what AI adoption and safe AI adoption can look like. And the first thing I wanted to address is the gold rush. this gold rush and this must need for AI adoption, AI usage and understanding AI within our organizations. Then I wanted to look at what are the risks. Some of the risks are well known, but I wanted to highlight some and I'm actually going to pull in some of the

neurodyiversity thoughts that I have around this subject and particularly around shadow AI and then talking through my little traffic light system of safe, strategic and sensible. How can we look at that in in that way? And as my AI notes have told me, by the end, I hope you'll be equipped to embrace AI benefits without involved exposing your organization to unnecessary danger. As say I did this on Wednesday, so Oh, sorry. Say hi to me. The um the images that's quite a good one, I thought. Um we are in the AI gold rush. How have we found ourselves here? Um, as my statistics earlier showed, it has been through business push and initiatives that we have got to use AI because of

FOMO. Fear of missing out. Why? Because everyone else is doing it. It's the new shiny kid. It's the Laboo of technology. Well, does everyone know what a Lubu is? I'm branching on to K-pop demon hunters theme here. Nuba is the most frightening children's toy next to the gremlin things I used to have back in the uh 80s9s. It's terrifying. I have no idea why my children are obsessed with them. Luckily, I just buy the $7.99 off the market next to the 60 price mark that the um the retailers ask for. But ultimately, it's the fear of missing out. Organizations are looking at how they can either use AI, how they can sell AI or how they can adopt AI within

their firms or organizations um to deal with their competitors. But in fact, nearly twothirds of CEOs admit that the FOMO has driven them to invest in AI and new tech without actually fully understanding why they're doing it in the first place or what it is. Last statement being the most concerning there, not really understanding the tr understanding what AI technology is. Some results have given us some quite staggering statistics that 25% of uh on kind of back in 2024 to 2020 2025. So the recent AI initiatives have even met their return on investment expectations. So what they thought they were investing in actually it hasn't capitalized and a mere 16% actually reached their enterprisewide scale. Um I'm not a

numbers person but that makes three out of four AI projects underd deliver but the industry experts are not surprised. Most organizations are leaping in into AI because as we say I want it to be a term now AI is the nubu of cyber security. Um they're using it because they see that there is their trend and there is this expectation that there's problems be fixed but what they haven't addressed is the problem itself. They haven't looked at a strategic way of what that problem is without looking at other processes. Maybe other technology skills fit as to what can support them and what the clear business need is rather than that's shiny, that's new, I'd like to adopt that.

When we're looking at business um business initiatives, often cyber security is only brought into conversation when it's got anything to do with risk. uh regulation, but it's got anything to do with compliance and oh yes, we do want to have that certification, bring cyber in to make sure that we've got all of the tick boxes that say we can get it. It's not often that the security team aboard into that business and strategic move that businesses want to make. And when businesses get together or you have a see a board together, they don't have the true understanding sometimes what those non-urgent or illdefined problems can be. However, this really new shiny AI tool that I've heard of can

be the one to fix it, which then opens up that threat landscape and risk profile to so many different organizations. But recognizing that gold rush mentality, we need to push back against it as cyber security professionals and custodians of risk management and everything scary and labubuish about our K-pop demon hunters of AI. Basically, we need to push back to our businesses in really helping them understand what that can do if we aren't advising our organizations or people in using safe AI adoption. Our competitors use AI. Why aren't we? The board wants AI strategy ASAP, but it's our role in cyber to advocate for that measured approach. Fail fast or be intentional.

So, let's look at some of the key risks. Um, out of the out of the ones that I've um I've looked at here, I want to I want to have a raise hand. Can you raise your hand once as well to think carefully? I want to see what people just to feel for the room you actually think is the most the biggest risk of using AI. data exposure, expanded attack surface or shadow air. So if you think the biggest risk is data exposure, raise your hand. If you think the biggest risk is your expanded attack service, raise your hand. And if you think it's shadow AI,

I'm going to sit in the shadow AI because unfortunately that is actually going to encapsulate all of those that I've just mentioned and I'll explain why as we go through. So the most immediate risk and the one I suppose that we would first go that's the most dangerous is of course going to be that data exposure and I deliberately actually put that as number one. Um so any AI service particularly like your cloud hosted generative AI require you to input data. Um is everyone familiar with the Samsung LLM use? >> Yeah. They put source code into LM. >> Yes. >> Yeah. They couldn't get it back. We didn't learn our lesson there unfortunately. And that was a real

timely mistake. a re it was a horrific mistake recognized um but it was actually into chat GPT was LLM that they put their code into only to realize that that obviously then became part of the AI's training uh training model um and it was exalled externally there was nothing they could do to actually get that back um raised serious confidentiality issues the incident led Samsung to temporarily ban their employees from using chat GBT and of course all similar tools Who thinks that that's actually the right approach to completely ban it from number one cuz what they just going to use their phones. You've given them this wonderful tool that's suddenly helping them and then you take it away. It's like candy

from a baby really, isn't it? Snatching it straight out of their hands. The internal survey found that 65% of employees saw security risks in using their generative AI work. Um, and it's not just Samsung. Italy's data protection authority even block chat GPT nationwide until it added for their privacy control. Um, if you feel comfortable enough, has your anyone who works in here, um, has your organization at first just banned AI until they know more about it? Okay. Sickly deep sea. That one went down, didn't it? Um and how long just again open discussion how long and what was the process for them to start lifting those restrictions? um just through sort of standard acceptance criteria. Um

understand it, read the actual AI vendors policies, understand what they're doing with our data, how and why, um and what restrictions are around that and then out what adoption looks like >> and what came of it from that. um it accepted but you know if the organization I'm at the moment the the ability to access something like Gemini um also comes with a prerequisite that you do um an initial um sort of familiarization course on the uses of AI responsible uses of AI and how we use it in organization >> fantastic do you have a I need to get this term correct a bio AI policy >> uh no so we've um just wrapped it into

the standard Um, B A. >> Okay, perfect. >> The Sorry, the >> B Y O D. >> Yeah, the acceptable >> acceptable use. Has anyone got B Y O A I? I like saying it. B I E I O. >> B Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y O O A I >> bring your own. >> Bring your Sorry. >> A B C D E F G >> which actually is the same tune to Twinkle Little Star if anyone didn't know that.

update the song now. >> Um yeah, B Y O AI >> I imagine less thoughts. That's probably fine. >> Yeah. >> Um >> has one. Um well whilst I was student here uh we had to come up with an AI policy and the guidance we received was they were only one of

>> that's interesting >> that would be the opposite of pi Right. >> Okay. I wanted to point number two which was expanding your attack surface. Um and it's one way you can think well it's naturally of course any new technology is just going to naturally expand your attack surface but introducing the new AI um introducing AI systems or into the AI it's how much control you then going to have and how much third party does that AI system or company then use. So it's understanding that chain. We're now looking at AI adoption and AI technologies. Uh traditional software had known um attack vectors, but now your AI can introduce others. Prompt injection is an emerging threat where an attacker

manipulates obviously the AI model through their crafty inputs causing it to produce unauthorized uh outputs and bypass their select controls. What really conferns me and I know that it's in the uh top 10 OASP um top 10 for AI um is going to be poisoning data poisoning and and hallucination. This absolutely petrifies me when I know where the AI route is going forward in in terms of things like healthcare is going forward in terms of education. Um I work very very closely with um the port uh I'm from Portsmouth by the way if you haven't put up my accent. Um I work really closely with Digital City Portsmouth. I run their cyber security program and the amount of AI being

pumped into schools naturally because the children already use it. So at least have to teach them to use it responsibly. But the amount of mis and disinformation or bias that they're now coming back with or they're creating their own AIS, this is what my nines 10 and 11 doing. And some of it is frightening, but to actually directly poison misinformation uh data sources, standard agendas and and beliefs. I've had cases um I'm not unfortunately allowed to talk about exactly what they are because obviously they're being watched at the moment but with um ideologies activism and politics being the main one at the moment um we're seeing that AI is being manipulated to uh poison data sets particularly ones

that are looking at um affecting people of said age or dead minority groups and it is frightening because unfortunately there's no way to trace it back. The only reason we know 9, 10, and 11 aren't as aren't as clever as they think. When they start using school computers to do things like this, it can be quite easy uh to see who did what. But we have seen acts of data poisoning. Now, if we're going to be starting to use more AI technology in terms of using it for vaccinations, for example, I would extend the conversation. This is just theory. This is just theory. Obviously, the biggest drug in the market at the moment is the GLP1

medications used for weight loss. And we are seeing pop over all over the US that there are more modifications of the original use of the drug which was actually just used for diabetes. We're bringing that into the conversation early. We're seeing that that's being constantly con now. The way that the GLP1 medications are constantly be coming up with new innovative ways so quickly is because they are using AI to get to the answers quicker. Now what happen if that date is poisoned? Where's it stopped and where's it picked up? Because of the uses of GLP1 medications mainly being for aesthetic uses although it does still stand for healthcare uses. It seems to be bypassing controls but

also you can buy it online. You can buy you can also find out how to make it online and that frightens me. Um I've completely off track. I can't even that one. Let's go to Shadow AI. This is one I'm actually very passionate about. And the reason I put two hands up, two feet off the ground, not by other choice cuz I'm quite short. Shadow AI by by you. We we used to have shadow it. So people plugging in really new fancy keyboards and mouses cuz they had carpental syndrome or something. Now they're using shadow AI against their organizations knowing they're using AI. There can be two reasons for this. There can actually be more than two, but

the first one is they know they're not supposed to use it, but it helps them and they're going to use it anyway. Second reason because the uh organization is so strict on the control of AI that obviously humans, we're not nice people. hate to break it to you all, but we do like to just do things which the easy way out and we do like to cut corners. We do like to find desire paths and if it means we're going to get our job done quite quickly, then we're going to often do that. Not everyone in the house of Hufflepuff like me, where honesty and integrity is part of our core values. Hufflepuff. Um, but the the number three use for

shadow AI, which is one I talk about quite a lot and one that I've been banging the drum on quite heavily for the past few months. AI is fantastic for neurodyivergent people. It helps us because you wouldn't be able to read a word I've written on that screen otherwise because my spelling is so horrific. It helps me making sure I'm on time for things. It helps me get the words that are in my brain into a piece of paper because my brain works at a million miles an hour and unfortunately I don't know which browser playing music upstairs but AI for me has been game changer into helping the way my brain thinks which unfortunately

isn't quite fit always for the workplace. I'm very lucky that the organization I do work for is supportive and they do understand my brain things. Luckily, my boss knew me before he hired me, so he knew what he was getting himself into from the beginning. Um, but a lot of neurodeivergent characteristics are shunned in the workplace. People are too afraid of saying why they need extra support, extra areas, particularly when it comes to AI. They don't want to be seen that they can't do their job properly. So, they don't tell their organizations they're using this AI through fear and nothing other than that. It's not they're trying to just do the job quicker like my first one was, you know,

desire paths and things like that. It's because they're ultimately scared their employer will have a negative feedback on their uses of AI in the first place. And this is why fostering such a positive positive culture and understanding culture as to why people actually use it in the first place, whether it's for business need or personal need. Right? I do have gone to that in slide. How long have I got? >> Uh 12 minutes. >> Oh, bloody hell. >> I got about six pieces of paper. Right, I got to go through this quickly. Okay, so with any AI adoption, and there's probably things that you're already looking at. Is it safe? We all think no. So, unfortunately, we've all answered

that. But how do we look at what is safe? How are we defining what safety is? Is that with regards to security? Is it safe with regards to privacy? And is it safe with regards to compliance? Mainly on the compliance side. When you're using AI, have you looked at where that data is stored in terms of geographic location? Unfortunately, a lot of data centers being used by AI companies and technologies are storing their data in places that we really don't have our sensitive data unfortunately. So, look at the compliance piece and having making and making sure that you are then staying in your regul your regulatory controls is one of the key ones that I'd also like to point out.

How are you assessing your risks with regards to a third um how are you assessing your risks like we've discussed before about data leakage about vulnerabilities are you using your traditional risk methodology methods because trust me that won't work not with AI we need to think of things differently and have you looked at adopting an AI risk matrix specifically your third party vendor relationships how you approaching that with regards to AI and uses of AI with regards to your vendors because if your vendors are using AI and using AI note takers and they have a meeting with you or they have access to your environments, how can you then be sure exploring those relationships with how your vendors are

using AI is also really important. I'm just going to buzz with this cuz I've only got 9 minutes now and I want to get on to the piece. 10. >> Okay, fine. >> My role is it strategic. This is the conversation I have on an alley basis with everyone throughout my whole organization through to our cyber security team to our ID team to our engineering team, product platforms, you name it. But is it strategic or is it just the new shiny thing that is taking your attention? How is this overall going to save money, fix the problem we have and is it a strategic move for the whole organization? Is there another way that we can look at doing things or is there

another version of what AI that you're looking at? AI adoption aligning with business goal aligning with business goals is where we should start with our first problem. I'm literally just cutting through this because I'm I've got lots more to say. Maybe we can catch up with coffee. [Music] And is it sensible? Is AI actually sensible? I'm going to answer it. Yeah, it meant I like I had a presentation ready much before Wednesday. Um, I think it is sensible. It's a sensible business move for businesses to adopt and use AI ethically and responsibly. There is a user case for every organization out there for AI, but it's just finding the right solution for you and not getting caught up in the AI hype

of look what it can do at what extent and at what cost and what risk. That's the questions we should be asking rather than what it can do. I can't do that as well because I really want to get into which I know gentlemen are as well. Oh, I've got a really long slides here. Just to make sure I get to the culture piece first. I'm going to do a bit of a mix match. So, I'm go I'm going to go back just depending on how much time we have with regards to risk methodologies. I really want to start talking about the culture piece with regards to AI adoption. Culture beats controls hands down. every

single time your culture will be controls. When we're talking about AI and clear AI adoption, it all will ultimately always come down to our risk aware security culture. When thinking of our organizations and thinking of everyone in this room, actually we have quite a high risk appetite when it comes to AI. All of us are like, "Oh my gosh, get the swords out." the rest of the organization. They understand why it can be dangerousish. They don't understand why the wise behind it. They also don't understand that when you got a no in front of you, that pathological demand avoidance that we always have goes, why not? I want to use it. It makes my job easier. It makes

me makes everything I do a lot more streamlined. means I can get on with the other tasks that I need to I need to get on with my day because my workforce just keeps on growing and growing. But let me ask you, you mentioned down at the front, how many of our organizations have even taught people how to use AI? Like 101 had one hand. I didn't see this. We had a couple. How well do we have a lecture once? >> We had a lecture once. It's like the internet all over again. >> I remember we had um a Hullet Packard. It was green. It was brilliant. And I remember we got it and I was one of the

first kids to get this computer. I ever taught how to use it other than paint and um Enarta three cart. Does everyone remember that? That was >> in Carter 9. I mean, what a what a program. >> Yeah. But what did I do? Oh, no. I went on to chat rooms, >> right? But no one ever told me the dangers of ASL. But ultimately, what do we do now in schools? We talk about online safety. Talk about day. So, I can't not reach the floor anymore. Giving me a backachche. Turned into the four-year-old child again. the dangers of the internet. Unfortunately, we we leashed that on to uh to the to the to the general public

without fully supporting them. And now what do we have? We're fighting those fires within terms of people not understanding privacy misinformation online following radical you know following radical um following ideology views um selfradicalizing themselves placing themselves in danger and I would love to put money on that we wouldn't have so much cyber crime if we just adopted it a bit more safely in the beginning we taught people how to use the internet in the very beginning with safe adoption. If we start, we're a bit late now actually. We've kind of missed the boat, but it doesn't mean we should not do it. We should help people, not tell them. Help them understand why do they need

AI, how to use AI, how to understand AI outputs, how to understand AI inputs, how to perform personas, but too much information away, but to get the best out of AI so you're not getting biased information, but also feeding back into AI to make sure it's also not replicating biased information as well. But your culture around AI shouldn't just be about scary scary no. It should be about okay, I can see you want to solve that problem. How does it help? How can we make sure that you're being supported in the right way to adopt AI safely? Where was I next? And it doesn't just mean with your first two to three levels of workforce. It also includes your

leaders. Your leaders are not exempt from training. Unfortunately, they've grown up. They've not grown up with AI. We are all new to this to an extent. If we're really definitions of AI, then we can really go into it. I've only got 5 minutes remaining. I told you you're going to have to chase me around getting up. But um educated your employee your uh your leaders should also be high on the pertinent list of who needs to have training with AI. If we're using it to search hat GPT for K-pop Dean Hunter lyrics or how can I do this quickly? Guarantee your CEO is doing it. I can guarantee a CEO is putting in uh putting in prompts asking

about what differentiator what's market looking like how can we look to do this what data can I drive from this but who is going to stand up and say you need training on how to do that. So as cyber security professionals, it's actually our job to face the CEO, which can be sometimes intimidating. It's just a knock on the door. Simon, I need to speak to you. but actually calling out that everyone in the organization regardless of what status or where you hold needs training in AI adoption and keeping an opening that open communication and reporting having feedback with your managers from all areas of the organization into where AI is being used not as blame as a okay

I can see how that can help you let's see if it's safe let's see if we can adopt that to make it better for teams and users is and integrate your AI into cyber hygiene security awareness training. I would hope we've all done that already. That's AI usage and risks are included in the cyber security awareness training. >> There's only one in the room which is frightening me. >> We are doing that, right? >> Yes. >> Okay. Good. Good. Great. Um but how how are we doing that? Are we only focusing the risk of AI itself? Are we looking at you prompts to be the danger of AI? Are we looking at just the frivolous

yes, I'll join a meeting and yes, I'm not going to question what that AI noteaker is because you, Mr. Customer, I want your business. Are you having conversations with your sales department, your marketing or your bid teams? in when they join a customer call and that customer is using a AI note taker that they then question that are they trained and able to handle those conversations take that back from employee and say hey I've noticed this are we training our sales people in actually calling that out to go back to the respator because I really want to get this one up as well anyone remember Springer >> I'm really old I'm really Okay, Jerry Springer was a horrific talk show and at

the end here we did final thoughts. So I prompted AI with a picture of myself which looks nothing like me when it came up with that. I hope yeah that's about it. Um I mean I'm not a lying way either. I do maybe need some reconstructive surgery. I wouldn't mind doing a a Kim whatever name generous. So I wanted to just now talk kind of wrapping things up and giving people to the chance to ask some questions and share thoughts and of course a ideas that we can share in our community as to what works and what thoughts they have. Um it's mostly when we're talking about AI about our responsible stance. We are leaders in this space whether you

believe it or not and you're maybe at the start of your career you're already leading. You're already leading others. You have more knowledge than others do within organizations, your friends, your family, understanding safe cyber related activities and habits and it is extending to AI uses. How many of us had actual conversations outside of work but with our family about AI uses? man's main with my teenager and I'm just begging him to actually do his homework rather than just getting AI to use that. But how many of us are talking about not just AI outputs but hey distance information bias how you how many of you have looked there's so many hands going here which is fantastic. How many of you are saying

the different or highlighting the difference between googling and AI searching? Because a lot of us are AI searching without even realizing when we go into Google and we put our first search in the first response is AI and a lot of us then won't question and won't then scroll down. It's not time not done. I told you I'll move >> more minutes. >> Thank you. Cuz there's a really important side after this one. >> Hype cyber security professionals. Are we on board with the EU EU AI at? >> Yeah. Yeah, cool. Look that up. That's great. By example, um handle responsive data come a competitive advantage. This is one I really want to speak about

as well particularly from my role as a visa is how we frame cyber as that competitive differentiator and advantage within our organizations. How many of you in the cyber security team are actually called into conversations about business initiatives that have commercial value? You do everything. You are involved. You've got your fear and every part your bed work. Are you allowed to say >> sorry? Okay, fine. I'm all over it. >> But actually, by handling your own data and your customers data through your responsible uses of security tools, AI, data handling, that's a differentiator. That's something that you should be singing from the rooftops. Um when I joined Advanced, one of my um first initiatives was launching our trust

center. Has anyone heard of trust center? >> Anyone use it? >> Yes. >> Do you like it? >> Yes. >> Fantastic. A trust center is basically a third party piece of software that I bought. Um I joined the company and I was like, give me this big bunch of money. I'm buying something. >> Is it trust? >> I'm not saying anything. Um, a trust center is an extension of an organization's website which has all of your regulations, your compliance and information with regards to security, risk, legal, AI, all available for the public to view because trust is earned not given. We have want to be transparent and when I asked earlier if anyone heard of advanced and then I said for the

right reasons few years ago we were victim to a cyber And we are building our reputational damage back from that. And one of the ways for us and for my steering has been through building our trust center in showing our lessons learned. Not everything is available on there in terms of you to go on there and go right where there incident response plan. Bingo got a way in. No, we just talk around methodology behind it. We can you can view our certifications like our ISO 27,0001 our cyber essentials plus there's something we actively use for our customers to say hey we know we're a very high um high-risk partner to you I mentioned we support the 111 if that went down

I'd be very very stressed out so we're we are a high-risk third party manager third party supplier to many many uh critical um partners in in across the UK. So having a trust center is our work in that sense. We really are doing everything that you need us to be doing and to prove that we'll put it in one place for you to go and look at. It's trustance.com if anyone wants to have a little look. Um it is a we're in phase two at the moment but trust and responsibly look after data and showing your hand with what you're doing with security what you're doing with AI that supports your organization that is brand

definition right before I do really get kicked off this stage there is something else I want to speak to you about this is the safe code promise So, um, I'm going to stand up for this bit because I don't need notes. [Music] Myself and Manoj, we are judges for We are judges. I can't move over. We are judges for uh two security awards. One is the next CSO and one is the CSO 30. Uh, these are you don't have to pay to lay. um and the award in the on the 27th of November to recognize individuals for the fantastic work they are doing in cyber security for the next cso we're looking for junior members to mid mid senior

members of team to call yourselves out I as a judge am telling you face to face I respect receiving a selfnomination more than someone who's nominated you because self advocacy is one of the most important tools you can learn from growing out your career. As much as we like to think people are going to do it for us, unfortunately no one's got time, no one's got time to go through all these these extra initiatives or if you have got a fantastic CEO and you do want to do them also the CESO 30. But personally as a judge, >> is there anybody that's a CEO 30 in here? >> I don't know. Hazel, is there a CESO 30

in this room? >> I got one of those last year, didn't I? >> Hazel received one last year. >> Self advocacy. >> It's really hard for us to think I don't want to make out. It's really hard to blow our own trumpet, isn't it? It's really hard to get imposter syndrome when we're writing about ourselves or we're trying to say, oh, am I that good or I don't know. But I'm actually begging you because cyber security is filled with glass ceilings. It's filled with the same people. You always see the same individuals who promote really great cyber security on stages on LinkedIn. And there's nothing wrong with that, but having more greater content. I thought you were coming. I just saw

orange move. I'm going to run up those stairs. Um, we need to hear more. We need fresher views. We need to hear views from different people. Please, if you haven't already considered, nominate yourself. If you know someone who you think does a fantastic job, ask them to nominate themselves or go through the nomination with them. If you are uncomfortable, say, can you help me nominate? Let's nominate each other, please. And I look forward to receiving lots of applications. Ry, I'm done. I'm going to run.